EXPRESS MAIL LABEL NO.: 
WHAT IS CLAIMED IS: 

1 . A method for identifying spoofed emails, the method comprising the steps 
of: 

receiving an email addressed to a recipient in a first network, the email 
including a plurality of headers, wherein at least one of the plurality of headers 
includes a sender address; 

determining whether the sender address indicates a mailbox from within 
the first network; 

modifying the sender address if it indicates a mailbox from within the first 
network; and 

sending the email with the modified sender address to the recipient. 

2. The method of claim 1 , wherein the receiving step comprises: 
receiving the email that includes a "sender" header field that includes the 

sender address. 

3. The method of claim 1 , wherein the receiving step comprises: 
receiving the email that includes a "from" header field that includes the 

recipient's address. 

4. The method of claim 1 , wherein the receiving step comprises: 
receiving the email that includes a "reply-to" header that includes the 

sender address. 

5. The method of claim 1 , wherein the step of determining comprises: 
determining whether the sender address matches any one of a plurality of 

domains and/or sub-domains associated with the first network. 
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6. The method of claim 5, wherein the step of modifying comprises: 
modifying the sender address if it matches any one of the domains and/or 

sub-domains associated with the first network. 

7. The method of claim 1 , wherein the step of modifying comprises: 
appending a predetermined sub-domain to the sender address. 

8. The method of claim 1 , wherein the step of modifying comprises: 
modifying a domain and/or sub-domain of the sender address. 

9. The method of claim 1 , further comprising: 

receiving a second email, the second email being from the recipient and 
being addressed to the modified sender address; 

modifying the modified sender address so as to return it to its original 
form; and 

sending the second email. 
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10. A computer program product for identifying spoofed emails, the computer 
program product comprising: 

a storage medium readable by a processing circuit and storing instructions 
for execution by the processing circuit for performing a method comprising the 
steps of: 

receiving an email addressed to a recipient in a first network, the 
email including a plurality of headers, wherein at least one of the plurality 
of headers includes a sender address; 

determining whether the sender address indicates a mailbox from 
within the first network; 

modifying the sender address if it indicates a mailbox from within 
the first network; and 

sending the email with the modified sender address to the 
recipient. 

11. The computer program product of claim 10, wherein the receiving step of 
the method comprises: 

receiving the email that includes a "sender" header field that includes the 
sender address. 

12. The computer program product of claim 10, wherein the receiving step of 
the method comprises: 

receiving the email that includes a "from" header field that includes the 
recipient's address. 
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1 3. The computer program product of claim 1 0, 

wherein the determining step of the method comprises determining 
whether the sender address matches any one of a plurality of domains and/or 
sub-domains associated with the first network, and 

the modifying step of the method comprises modifying the sender address 
if it matches any one of the domains and/or sub-domains associated with the first 
network. 

14. The computer program product of claim 10, wherein the modifying step of 
the method comprises: 

appending a predetermined sub-domain to the sender address. 

15. The computer program product of claim 10, wherein the modifying step of 
the method comprises: 

modifying a domain and/or sub-domain of the sender address. 

16. The computer program product of claim 10, wherein the method further 
comprises the steps of: 

receiving a second email, the second email being from the recipient and 
being addressed to the modified sender address; 

modifying the modified sender address so as to return it to its original 
form; and 

sending the second email. 
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17. A computer system for identifying spoofed emails, the computer system 
comprising: 

a receiver receiving an email addressed to a recipient in a first network, 
the email including a plurality of headers, wherein at least one of the plurality of 
headers includes a sender address; 

a processor determining whether the sender address indicates a mailbox 
from within the first network, the processor modifying the sender address if it 
indicates a mailbox from within the first network; and 

a transmitter sending the email with the modified sender address to the 
recipient. 

18. The computer system of claim 17, wherein the receiver receives the email 
that includes a "sender" header field that includes the sender address. 

19. The computer system of claim 17, wherein the processor modifies the 
sender address by appending a predetermined sub-domain to the sender 
address. 

20. The computer system of claim 17, wherein the processor determines 
whether the sender address indicates a mailbox from within the first network by 
determining whether the sender address matches any one of a plurality of 
domains and/or sub-domains associated with the first network, and 

the processor modifies the sender address by modifying the sender 
address if it matches any one of the domains and/or sub-domains associated 
with the first network 
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